[Autogenerated] this face of the compliance journey starts
with understanding where we trying to get to,
which is what we looked at in the previous module.
We need to now know what compliance looks like for the organization.
How do we need to provide evidence of our compliance by reporting
compliance or self assessment question there?
Who are we going to give evidence of compliance to an acquirer,
A card brands or to a merchant or a financial institution?
I know why we giving it to them.
Why are they asking us for it and therefore, how insistent are going to bay?
When are we being as to comply by?
Is it next month or next year?
Appreciate some indeterminate time in the future.
We need to know that we also need to know if it's negotiable,
and then finally to questions that people often down asked.
But you must.
Firstly, what?
What happens if you don't comply?
What sanction is available to the organization that is asking you to comply?
Because in the short term,
perhaps that sanctions actually just worth paying while you
spend longer doing compliance properly rather than rushing
into something and then finally,
how flexible is the organization that's asking you to comply with PC idea says,
Going to be if you come across an insurmountable problem.
For example, if your organization haven't budgeted next year to do PC,
Idea says compliance, and then you came across something.
How much can you negotiate?
Do you know who you would negotiate with on with the
answers of those questions in place, You know,
need to pull your senior team together because you're going to need a lot of
help within the organization to become PC ideas s compliance.
And here I'm not looking for you to define the team that
will deliver a PC I project or programme.
What I'm looking for is for you to identify and pull together
the key business people who were the key payment security
stakeholders in the organisation.
Firstly,
who owns the relationship with the organization
that's asking you to comply with PC?
Idea says,
because it's that person who will be the link to the requesting organization
and is that person who be negotiating what compliance means.
If you need to negotiate,
you're going to have to spend a lot of time with this person
because you'll need to educate them about what compliance is
that is not strictly black and white,
that there are different ways of demonstrating compliance on that.
Compliance can be a negotiation.
In fact, if you could persuade that person to take this course on the PC idea,
says the big picture course, that would be a great thing to do.
The second set of stakeholders you need to identify for the
business owners for each acceptance channel.
Who owns the website?
Who was the retail stores?
Who was the call Central Contact Center?
Because if you need to change their business processes or the
technology that back part of the business relies on,
you need to know who these people are on.
Remember, their problem is not PC I compliance.
There probably is usually a combination of increasing revenues,
minimizing costs and providing excellent customer service.
So they're not going to be focused on PC I.
D.
S s in the same way that you are.
Thirdly, there's probably going to be some cost involved in becoming Pacey idea,
says compliance.
We don't know how much that is yet,
but you need to start to identify who will be responsible for getting hold
of that budget and making sure it's spent just on the PC.
I complies things that need to be done and that it doesn't
become what I've seen in many organisations,
which is an excuse that's used by anyone that wanted some
budget to upgrade anything to steal.
Pacey I money for.
It's like, Oh, PC, I says We have to upgrade this.
It might do, but you wanted to write that anyway,
To be clear about who's paying for things,
you need to understand who's going to be responsible for delivering the program.
Is there a central program office in your organization you need to deal with?
Or is that you?
And finally,
you need to pick who is going to be executive sponsor For
all this change that's going to happen.
My recommendation is that it's the person you identified
who holds the relationship with the organization that is
asking you to be compliant.
So if you're a merchant and you're acquire,
it is ask you to become compliant with PC idea cess when the
person in your organization but those the acquiring
relationship should be the executive sponsor,
I would never recommend that the executive sponsor is someone in the
information technology or information security Department because
then PC I DSS will be seen as an I T.
Or in Passaic problem.
And it's not.
It's a people process and technology problem that will require
change often throughout the whole organization.
Now we come to the first of two times,
but I think an organization needs to really think hard
as part of this compliance journey.
Becoming compliant with PC Idea says, is no easy.
I have no some very large organizations who have taken 10 years
to do this and still haven't quite succeeded.
It requires commitment funds on a real desire from the
organization that is going to achieve it and not just pay
lip service to trying to achieve it.
And so the first question that any organization should ask itself is,
Does it really want to do this because, believe me,
1/2 hearted attempt to BP just waste money.
He doesn't get you more compliant except for maybe a few months,
Or does the organization want to start some sort of compliance
tick box exercise so it could show in a choir?
It's doing the right thing,
but it's not actually ever going to become compliance,
and the organization should think about it.
Security posture.
Does it want to use the opportunity of doing PC?
Idea says to become generally more secure because PC I DSS could
be a transformational step in an organizer.
Security.
It could be the catalyst for upgrading things that have long needed an upgrade.
And it could be a catalyst for implementing bassline controls in an
organization that did not have such controls previously.
And then the fourth hard thinking question I recommend every organization,
addresses and addresses at this stage is to what extent
they should get external help now,
because there will be a number of technical organizational
business approaches that can be taken.
And each of these approaches will have a different cost of
achieving compliance and come with a different cost again
of maintaining compliance.
You may be surprised to know that my personal goal is always to
minimize the cost of maintaining compliance,
because I've seen so many organizations that succeeding,
becoming compliant but find the maintenance of compliance almost impossible.
And so,
for organizations that have no approached the big
regulated security programs before,
I don't recommend that I think about engaging with external assistance.
Now there's a very early stage of the journey to provide input
into what we end of the journey should look like.
So,
one of the big thinking questions I always try to address is how much
PC Idea says there's an organization want to do?
Does it want to do every system?
What does he want to do?
No systems.
Because the more systems that have to comply with PC idea
assesses about 300 prescriptive requirements,
the slower and more costly change will be in the organization.
So for highly flexible,
agile organizations maintaining regulated security maybe a cost of doing
business that they don't want to accept alternatively,
other organizations use.
DSS is the catalyst to improve their general security posture,
in which case they may choose to have the majority
of their organization systems.
People and processes comply with those 300 or so requirements.
And then we also need to consider how doing PC idea says allies with the
organization's current security and compliance posture.
So an organization that is already regulated for
security by a different regulator say, for example,
they may have to comply with the data security requirements for
healthcare data they will find doing PC idea says much more easy
than an organization that's got no experience of doing externally
assessed security and compliance.
Similarly,
those organizations with no experience or culturing doing
security compliance should not aim to do lots of PC,
Idea says,
because the organizational change the cultural organization
changed required means that they'll probably fail.
And I've witnessed countless organizations without a maturity
security based on with with no culture of demonstrating their
security process to anyone else ever before,
try to apply all the PC idea says requirements to
the whole of their organization.
I can guarantee that approach will always result in failure.
I really wouldn't recommend that.
Here is another example where an organization wants to little security
and little PCO but wants to be completely compliant.
This forces air strategy of outsourcing,
giving both the security and PC I compliance problem to another organization.
So asking the questions of how much security and how much compliance and
how much PC I an organization wants to do can shape the program and it's
so much better to do it at the beginning rather than halfway through
when the program is struggling